Strengthening Human Risk Management and AI Governance

The organization's Cybersecurity Manager is responsible for implementing and maintaining security controls across the business. The role focuses on following established security frameworks to reduce risk, strengthening employee awareness, and helping the organization safely adopt emerging technologies.

Today, one challenge sits above many others: managing the rapid adoption of generative AI.

While AI presents significant opportunities for productivity, it also introduces new concerns around governance, data protection, and employee behavior. Employees may unknowingly upload sensitive information into unauthorized tools, use personal AI accounts, or interact with services outside approved security controls.

At the same time, attackers are increasingly using AI to create more convincing phishing campaigns, replicate communication styles, and improve the effectiveness of social engineering attacks.

For many organizations, phishing simulations are judged by a single metric: reducing click rates. The Cybersecurity Manager takes a different view.

While unconventional, this philosophy reflects a practical reality. Real attackers are not sending easy phishing emails designed to be caught. They use increasingly sophisticated tactics, many enhanced by AI, to deceive employees.

Rather than optimizing for vanity metrics that serve only management, the organization focuses on preparing employees for the kinds of attacks they are most likely to encounter.

In his view, the most valuable metric is not the number of employees who report a phishing email or pass a simulation, but the number who fall for a convincing one. A user who catches an obvious test learns little. A user who is genuinely fooled walks away having learned exactly how they can be deceived, and that lesson sticks.

For that reason, the organization focuses on creating realistic simulations that challenge users and generate meaningful learning opportunities, tailored to reflect real-world scenarios and organizational context.

When employees encounter particularly convincing simulations, discussions spread organically across the business, shifting awareness from a compliance-driven activity into an active risk management function.